Eliminate ${VAR} substitutions from docker-compose.yml

Move DATABASE_URL and POSTGRES_PASSWORD to .env via env_file.
docker stack deploy no longer needs env vars sourced, and
repeat deploys won't trigger spurious restarts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -55,7 +55,6 @@ jobs:
         run: |
           ssh "root@$DEPLOY_HOST" "
             cd /root/art-dag/activity-pub
-            set -a && source .env && set +a
             docker stack deploy -c docker-compose.yml activitypub
             echo 'Waiting for services to update...'
             sleep 10

docker-compose.yml

@@ -3,9 +3,10 @@ version: "3.8"
 services:
   postgres:
     image: postgres:16-alpine
+    env_file:
+      - .env
     environment:
       POSTGRES_USER: artdag
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
       POSTGRES_DB: artdag
     volumes:
       - postgres_data:/var/lib/postgresql/data
@@ -45,10 +46,9 @@ services:
       - .env
     environment:
       - ARTDAG_DATA=/data/l2
-      - DATABASE_URL=postgresql://artdag:${POSTGRES_PASSWORD}@postgres:5432/artdag
       - IPFS_API=/dns/ipfs/tcp/5001
       - ANCHOR_BACKUP_DIR=/data/anchors
-      # ARTDAG_DOMAIN, ARTDAG_USER, JWT_SECRET from .env file
+      # DATABASE_URL, ARTDAG_DOMAIN, ARTDAG_USER, JWT_SECRET from .env file
     volumes:
       - l2_data:/data/l2  # Still needed for RSA keys
       - anchor_backup:/data/anchors  # Persistent anchor proofs (survives DB wipes)